what's to stop someone from setting  --never-download to false?
and then it going out to pypi?